Resolved! Can't remove vsys specific SSL TLS Service Profile
This is a strange issue.
PA-3020 recently upgraded to 7.0.4. The firewall is in single vsys mode.
I installed new SSL certificates for Global Protect. Somewhere during the process of installing the new certificate and upgrading to 7.0.4, an ssl
...